CVE-2022-24447: n/a
Source CVE Database V5
Not known to be exploited · fixed in 6200 : patch affected systems soon.
Data as of 26 Oct 2026, 08:30 UTC
Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 6200
Exploitation evidence
Disclosed: evidence found.
CVE published 2 Mar 2022
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in
|
AI-suggested
To mitigate this vulnerability, European organizations should immediately upgrade Zoho ManageEngine Key Manager Plus to version 6200 or later, where the issue has been addressed. In the absence of an available patch, organizations should restrict Operator-level user privileges to only those absolutely necessary and audit existing Operator accounts for any suspicious activity. Implement strict access controls and monitoring on the Key Manager Plus environment, including multi-factor authentication for all users with access to certificate management functions. Organizations should also consider rotating SSL certificates and associated private keys that may have been exposed, to invalidate any compromised credentials. Regularly review and enforce the principle of least privilege, ensuring that only trusted administrators have access to sensitive cryptographic material. Additionally, network segmentation and logging should be enhanced to detect and respond to any unauthorized attempts to export certificates or keys. Finally, organizations should maintain an incident response plan specifically addressing cryptographic key compromise scenarios.
Description
An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.